CVE-2023-53514Missing Release of Memory after Effective Lifetime in Linux

Severity
5.5MEDIUMNVD
EPSS
0.0%
top 95.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 1

Description

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix memory leak of device names The device names allocated by dev_set_name() need be freed before module unloading, but they can not be freed because the kobject's refcount which was set in device_initialize() has not be decreased to 0. As comment of device_add() says, if it fails, use only put_device() drop the refcount, then the name will be freed in kobejct_cleanup(). device_del() and put_device() can be repl

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

NVDlinux/linux_kernel6.06.1.28+2
Debianlinux/linux_kernel< 6.1.37-1+2
CVEListV5linux/linux8aa5bcb61612060429223d1fbb7a1c30a579fc1f958c6cbc32996c375af42db96ceba021a1959899+4
debiandebian/linux< linux 6.1.37-1 (bookworm)

Patches

🔴Vulnerability Details

2
OSV
CVE-2023-53514: In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix memory leak of device names The device names allocated by dev_set2025-10-01
GHSA
GHSA-8gw4-3w27-23g9: In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix memory leak of device names The device names allocated by dev_s2025-10-01

📋Vendor Advisories

2
Red Hat
kernel: gpu: host1x: Fix memory leak of device names2025-10-01
Debian
CVE-2023-53514: linux - In the Linux kernel, the following vulnerability has been resolved: gpu: host1x...2023
CVE-2023-53514 — Linux vulnerability | cvebase